In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions ...

learn more… | top users | synonyms

10
votes
5answers
765 views

Why does PBKDF2 xor the iterations of the hash function together?

The definition of PBKDF2 states that I obtain a derived key* by calling a pseudorandom function a bunch of times recursively: ...
10
votes
3answers
731 views

PBKDF2 for key diversification

I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
10
votes
2answers
742 views

Deriving Keys for Symmetric Encryption and Authentication

So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ...
8
votes
1answer
419 views

Compressing EC private keys

For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure. I ...
7
votes
2answers
363 views

Key Length & Hashing

I need to use a hash function to generate a 128-bit key for a symmetric cipher. The specific cipher is from the eStream portofolio, called Rabbit. I am using the SRP protocol for authentication (a ...
7
votes
1answer
605 views

What's the difference between a Key Derivation Function and a Password-Hash?

It seems to me that anything that was sufficiently good as a KDF would work just fine as a password hash, though the reverse might not be true. Are there considerations specific to password-hashing ...
7
votes
1answer
407 views

Are there any authoritative definitions of “key stretching”?

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
6
votes
4answers
3k views

How can one securely generate an asymmetric key pair from a short passphrase?

Background info: I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
6
votes
2answers
1k views

How key materials are generated in SSL V3 from master secret

The generation of key materials is given by ...
6
votes
2answers
312 views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST ...
6
votes
4answers
783 views

Creating an encryption key from several other keys and using hash functions

I want to combine two or more keys to create a single encryption key that relies on all of them. What is the proper method for doing that? Simple XOR? Using hash functions? Something else? I ...
6
votes
1answer
160 views

multiple keys via HKDF - whats better, one or two applications of HKDF-extract

Assume for the sake of the question that I have two variable-length bit strings, each with 128 bit cryptographic randomness, and I want to extract two 128 bit keys via HKDF-SHA256. Which alternative ...
5
votes
3answers
228 views

Get permutations from password

Are there any "good" ways to get a permutation from a password/pass-phrase? If one, for example, wanted to get a permutation of letters from a password, how might one do that in a smart way? I would ...
5
votes
4answers
292 views

Are derived hashes weakening the root?

Given a root hash root = H(plaintext) and two (or more) derived hashes h1 = H(salt1 + root) h2 = H(salt2 + root) would the ...
5
votes
1answer
590 views

How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure: Using PBKDF2 with then entire 128 bit ...
5
votes
2answers
168 views

Multiple iterations of AES for key derivation?

The keepass password manager uses multiple rounds of AES for its key derivation, as described here. I was somewhat surprised that it wasn't using pbkdf2, bcrypt, or something more common. ...
5
votes
1answer
224 views

How random is the shared secret in the Diffie Hellman key agreement

Being triggered by this horrible implementation in I2P shown by Sergei at Stackoverflow, I would like to know how random the value ZZ in the DH protocol is. ...
5
votes
1answer
783 views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds I was left wondering why the key schedule of AES is invertable. In the paper the ...
5
votes
1answer
103 views

repeated use of HKDF-extract on the same PRK

Regarding HKDF (RFC 5869) - HKDF has two steps, extract and expand. Some answers on this site suggest that you can extract once, and then generate multiple keys from the resulting PRK by multiple ...
4
votes
3answers
123 views

using elliptic curve point multiplication as a key stretching method

My friend came up with the following idea: assuming we agreed on curve parameters, use the following algorithm for key stretching/derivation from user-entered password. Pad the ascii representation ...
4
votes
2answers
439 views

Questions about Key Derivation Functions

My understanding is that a KDF is a function that takes a master secret and generates multiple keys. It is secure as long as the keys are "independent". If this is true, the following definition would ...
4
votes
1answer
130 views

Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
4
votes
1answer
1k views

How does PBKDF1 work?

I need some basic guideline on Password Based Key Derivation Function. PBKDF1 generates a key from password and salt using Hashing algorithm (like SHA1, SHA256, MD5). What is the step behind this?
4
votes
1answer
218 views

Key collision in scrypt and hkdf

I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) ...
4
votes
1answer
264 views

Using a derived key for CMAC

Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication: Two keys are derived from the master key k (16 byte): ...
4
votes
2answers
319 views

Can I use guids / uuids as counters for key derivation?

I have a 512 bit master key, and 128 bit unique identifiers. I'm going to derive 256 bit keys to for use with deterministic and block ciphers. For reference, The KDF I'm going to use is Hash( C | ...
3
votes
2answers
334 views

Simple RC4 key generation scheme

I would like to ask you about your opinion on the following scheme of combining a master key and a nonce and stretching the result to the full 256-bytes RC4 key. Master key $K_m$ is a pre-shared ...
3
votes
2answers
2k views

AES encryption using a Diffie-Hellman key exchange

I have two systems which need to encrypt their communication by AES-128. The key for the AES encryption should be exchanged with the Diffie-Hellman (DH) algorithm. Now, I've read about DH and got a ...
3
votes
2answers
372 views

Reason(s) for using a KDF for encryption keys

Assuming I already have a 256-key (32 char password) for AES encryption, comprised of random alpha-numeric characters and punctuation (95 possible ascii chars), generated by a decent PRNG, is there ...
3
votes
4answers
3k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
3
votes
1answer
242 views

How safe is it to derive MAC key from a hashed password?

Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password ...
3
votes
3answers
218 views

Derived Shared Key vs Distinct Keys?

I've seen a lot of 2-party applications that derive a shared key from distinct keys created by each party. Why is this technique employed? Would it not be better to use those two distinct keys for ...
3
votes
2answers
79 views

Is it possible to insert a key derivation function when using EAX?

I am currently investigating use of EAX mode for a dedicated application and following useful clarifications received from my previous post , to consider according to my applicable input security ...
3
votes
1answer
360 views

Can I secure my key by XORing it with a hashed password?

I'd like to build a simple password-protected symmetric key system. The key-creation process in my system operates as follows: The system creates a 256-bit key purely at random. The user chooses a ...
3
votes
2answers
153 views

Encryption Key derivation from numeric PIN?

I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms. I found a nice example ...
3
votes
4answers
467 views

Generate Elliptic Curve Private Key from User Passphrase?

I'd like to generate a private elliptic curve key from user input like pass phrase. Is the best way to do this with a key derivation function like PBKDF2? Is there a better way? Edit (based upon ...
3
votes
1answer
197 views

What's the most secure way to derive a key from a password repeatably?

I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent. Currently, the flow looks like this: User ...
3
votes
1answer
73 views

What is the GnuPG process for going from a passphrase to a symmetric key?

Suppose I use GnuPG to symmetrically encrypt a file like so: gpg --no-options -c --cipher-algo AES256 --no-random-seed-file -o my.out my.file I then provide a ...
3
votes
1answer
244 views

Recovering state of modified RC4 key scheduling algorithm

Consider this algorithm: ...
3
votes
1answer
144 views

Derive a public EC key from two public EC keys

Alice has two EC key pairs: $a_1$, $a_2$ are private keys (integers), $A_1$, $A_2$ are the corresponding public keys (points). Alice and Bob want to create a new public key $C$. Alice must prove that ...
3
votes
2answers
120 views

Asymmetric key derivation – Who derives the new pub key can't know the new private key

I'm looking for a peer reviewed protocol or algorithm that can do this, preferentially I need something based on elliptic-curves cryptography. Alice know the main public key of Bob (B-PUB-1). Alice ...
3
votes
1answer
176 views

AES-CTR with ephemeral keys vs IV

Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several ...
2
votes
3answers
215 views

Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?

Could you choose the number of PBKDF2 iterations based upon the system time? I've heard a few people recommend that the number of iterations for PBKDF2 should be doubled every two years (starting ...
2
votes
2answers
101 views

KDF with low-entropy salts

I need to derive a key from a username and a password. These are the only two things I have access to. What I thought is using PBKDF2 with username as the salt and password as the master password. ...
2
votes
3answers
360 views

Master keys for decrypting?

I'm not a Cryptography expert, but i've seen this topic sometimes on the Web: Master decrypt keys. Most of the people said that "Master decrypt key" does not exist. This makes sense if you developed ...
2
votes
1answer
82 views

Proof of shared secret through key derivation

Alice gives a random key $K$ (e.g. 32 bytes long) to Bob through a secure channel. Bob want to prove to Alice through an unsecured channel that he knows the key. Is it secure for Bob to send ...
2
votes
1answer
169 views

Generate key pair deterministically from a particular seed

I've been reading "SQRL Secure QR Login" at Gibson's website, and I'm wondering if there is a way to generate an RSA private/public key-pair based on some cryptographically secure input, so that if ...
2
votes
3answers
249 views

How can I accomplish Key Derivation in JavaScript?

I need to take a potentially weak user password and derive a strong key for AES encryption in JavaScript. How can I do this? I expect the hardest problem is generating a good random salt - perhaps an ...
2
votes
1answer
285 views

Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
2
votes
1answer
122 views

What information to include is the 'info' input for HKDF?

The RFC states the following: 3.2. The 'info' Input to HKDF While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main ...